SQL injection in PHP pdo_firebird via NUL bytes in quoted strings. During PDO::prepare, the pdo_firebird driver reparses and reconstructs the SQL statement token by token using the NUL-terminated strncat() in ext/pdo_firebird/firebird_driver.c. When a quoted string literal contains a NUL byte, strncat() stops copying at the NUL and drops the closing quote, so attacker-controlled input that passed through PDO::quote() spills out of the string literal and into executable SQL, enabling SQL injection (e.g. UNION-based extraction of database version details).